Migration from the old documentation
The previous documentation contained claims that did not match the actual implementation of Neuroon. This page lists those discrepancies and maps the old URLs to the new ones. We've published it as its own page so any integration based on the old docs can be corrected systematically.
What the old docs said → reality
| Topic | Old docs | Current reality |
|---|---|---|
| Widget Token generation | The client signed the token with HMAC-SHA256 from its server | The token is opaque, issued by Neuroon. TTL 24 h. See Widget Token |
| Widget distribution | npm install @neuroon/widget | CDN-only, versioned with SRI. The repo package is not published to the registry. See What's not supported |
| Global widget API | window.NeuroonWidget.init(), .search(), .destroy() | Doesn't exist. Configuration only via data-* attributes |
| JS callbacks | onSearch, onResultClick, onFilterChange, onError as extension points | Not wired up. TypeScript types exist but there is no public extension point. Use DOM CustomEvents |
| Official SDKs | "PHP SDK", "Python SDK", "Ruby SDK" | No official SDKs. Any HTTP client + JSON |
| API versioning | /v1/, /v2/ | No URL versioning. Compat by contract |
| Auth rate limit | "JWT per request to /api/search" | /api/widget/* uses X-Widget-Token, /api/plugin/* uses X-Shop-API-Key. JWT only on /api/search/* with OAuth2 |
| Origin validation | Not documented | Yes, it exists: 403 Origin mismatch for browsers; "no Origin = allow" for server-to-server clients |
| Sync maximum | "10,000 products per request" | 500 products per request. See ShopRequestDTO.java |
| FULL vs INCREMENTAL sync | Not differentiated | INCREMENTAL (upsert by externalId, recommended) vs FULL (deletes the index + reinserts) |
| Indexing | "Immediate after 200 OK" | Eventual consistency: 2–5 seconds before the product is searchable |
| Widget languages | "12 languages" | 9 (es, en, fr, de, it, pt, ca, eu, gl). es and en eager; rest lazy |
| Theme | Dark only | Dual: dark + light, with 60+ --nrn-* CSS vars (RGB-triplet format, --nrn-primary: 6 182 212) |
URL mapping
Old URLs that no longer exist. Each one redirects (or should redirect) to the new destination:
| Old URL | New destination | Status |
|---|---|---|
/getting-started | /get-started/quickstart | Active redirect |
/widget/install | /widget/installation/script-tag | Active redirect |
/widget/advanced/javascript-api | /get-started/whats-not-supported#global-widget-api-on-window | Removed |
/widget/callbacks | /get-started/whats-not-supported#public-js-callbacks | Removed |
/widget/hooks | /get-started/whats-not-supported#public-js-callbacks | Removed |
/api/auth/hmac | /authentication/widget-token | Concept removed (Token is opaque, not HMAC) |
/api/sdks/php | /get-started/whats-not-supported#official-sdks | Removed |
/api/sdks/python | /get-started/whats-not-supported#official-sdks | Removed |
/api/webhooks/outbound | /get-started/whats-not-supported#outbound-webhooks | Removed |
/api/v1/* | /api/* | Renamed (no URL versioning) |
/integrations/wordpress-plugin | WordPress | Active |
/integrations/dnn | DNN Recipe | New page |
Anchors for redirects
These anchors exist in What's not supported specifically so that redirects from the old URLs land on a useful destination:
#widget-npm-package#official-sdks#outbound-webhooks#global-widget-api-on-window#public-js-callbacks#http-api-versioning
Why did all of this change?
The previous documentation was built in parallel with prototypes that never reached production. As the product evolved, parts of the docs ended up describing aspirations instead of actual implementation. This version, tagged verified_at: 2026-05-06, has been verified against the source code: every technical claim links to the path:line that backs it.
If you find an additional discrepancy, open a ticket with Support and we'll fix it.
Further reading
- What's not supported — the canonical list of nonexistent capabilities.
- Changelog — change history.
- Quickstart — the real integration, in 5 steps.